quoteUntrusted() does not strip HTML tags, Unicode bidi overrides, or horizontal rules

Open Beginner friendly
#129 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
64/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
react, typescript
Domain
frontend, security

Research direction

Start in packages/mcp-shared/src/tools.ts at quoteUntrusted() and review how its defuseFences handling reaches the Markdown rendered by ChatInterface.tsx with ReactMarkdown and remarkGfm. Add focused coverage for the listed HTML, bidi, horizontal-rule, and strikethrough inputs; done means those patterns no longer alter approval-prompt formatting while ordinary text remains readable.

Written by the indexing model from the issue text.

Description

Summary

quoteUntrusted() in packages/mcp-shared/src/tools.ts (L160-168) strips headings and blockquotes from server-controlled text before rendering in approval prompts, but does not strip HTML tags, Unicode bidirectional override characters, horizontal rules, or strikethrough markers.

Affected Code

defuseFences only replaces triple backticks. quoteUntrusted strips # and > at line starts but nothing else.

Missing Sanitization

Pattern Example Effect
HTML tags <img src=x>, <details> Injected markup in rendered Markdown
Unicode bidi U+202E (RTL override) Visually reverses text direction, misleading the approver
Horizontal rules --- or *** at line start Breaks visual structure of the prompt
Strikethrough ~~important warning~~ Crosses out safety-relevant text

Impact

A malicious MCP server can craft tool descriptions that include these patterns. Since the descriptions are rendered as Markdown in the Workshop chat transcript (ChatInterface.tsx uses ReactMarkdown with remarkGfm), the injected formatting can mislead the user about what a tool does.

This complements the existing issue #42 (two of the three approval-queue descriptions skip sanitizers entirely).

Suggested Fix

Add stripping for the missing patterns in quoteUntrusted():

  • Strip HTML tags via regex
  • Strip Unicode bidi control characters (U+200E-200F, U+202A-202E, U+2066-2069, U+061C)
  • Strip horizontal rules (---/***) at line starts
  • Strip strikethrough markers (~~)

Previously submitted as part of PR #66 (closed per contributing guidelines).

Dominant language
TypeScript
Stars
10k
Forks
1.2k
Avg merge
1d 20h
Merged PRs (30d)
107

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from cloudflare/cloudflare-os

All issues in cloudflare/cloudflare-os

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.